Web Application Vulnerabilities Runtime SCA Findings
Looking for the vulnerability index of Invicti's legacy products?
Invicti Enterprise Acunetix Standard & Premium
Beego Framework Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability - CVE-2025-30223 - Vulnerability Database
Beego Framework

Beego Framework Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability - CVE-2025-30223

Critical
Reference: CVE-2025-30223
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2025-30223
Title: Beego Framework Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability
Overview:

Beego is an open-source web framework for the Go programming language. Prior to 2.3.6 a Cross-Site Scripting (XSS) vulnerability exists in Beego39s RenderForm() function due to improper HTML escaping of user-controlled data. This vulnerability allows attackers to inject malicious JavaScript code that executes in victims39 browsers potentially leading to session hijacking credential theft or account takeover. The vulnerability affects any application using Beego39s RenderForm() function with user-provided data. Since it is a high-level function generating an entire form markup many developers would assume it automatically escapes attributes (the way most frameworks do). This vulnerability is fixed in 2.3.6.